CI job updated to compile aws-lc-rs

Dockerfile.build

@@ -11,23 +11,34 @@ ENV DEBIAN_FRONTEND="noninteractive" \
     CARGO_TERM_COLOR=always \
     LANG=C.UTF-8 \
     TZ=UTC \
-    TERM=xterm-256color
-# With zig, we only need libclang and make
+    TERM=xterm-256color \
+    AWS_LC_SYS_PREBUILT_NASM=1
+# With zig, we only need libclang and make. ca-certificates is required for curl
+# to verify HTTPS downloads (zig tarballs, FoundationDB debs, crates.io, etc).
 RUN \
     --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     rm -f /etc/apt/apt.conf.d/docker-clean && \
     echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' >/etc/apt/apt.conf.d/keep-cache && \
     apt-get update && \
-    apt-get install -yq --no-install-recommends curl jq xz-utils make libclang-19-dev
-# Install zig
+    apt-get install -yq --no-install-recommends ca-certificates curl jq xz-utils make libclang-19-dev
+# Zig is pinned to 0.13.0. Zig 0.14+ changed how its default target ABI is
+# resolved for `x86_64-linux-gnu`-style triples, and on Stalwart's dep tree
+# (rocksdb, jemalloc, aws-lc-sys, libfdb_c.so, rust-std 1.87+) this surfaces
+# as ld.lld undefined references to pthread_*/stat/pow@GLIBC_2.33+. An
+# explicit glibc suffix (`.2.17`) is NOT a workaround — C deps compiled via
+# zig cc against Zig 0.16 headers still emit @2.33+ symbols even when the
+# linker target is 2.17. Zig 0.13 produces binaries with a max glibc ref of
+# ~2.28 which stays compatible with Debian 11 / RHEL 8. Revisit this pin if
+# Zig upstream stabilizes a backwards-compatible default or if Stalwart drops
+# its hard C deps.
 RUN \
     ZIG_VERSION=0.13.0 && \
-    [ ! -z "$ZIG_VERSION" ] && \
-    curl --retry 5 -Ls "https://ziglang.org/download/${ZIG_VERSION}/zig-linux-$(uname -m)-${ZIG_VERSION}.tar.xz" | tar -J -x -C /usr/local && \
-    ln -s "/usr/local/zig-linux-$(uname -m)-${ZIG_VERSION}/zig" /usr/local/bin/zig
+    curl --retry 5 -fsSL "https://ziglang.org/download/${ZIG_VERSION}/zig-linux-$(uname -m)-${ZIG_VERSION}.tar.xz" | tar -J -x -C /usr/local && \
+    ln -s "/usr/local/zig-linux-$(uname -m)-${ZIG_VERSION}/zig" /usr/local/bin/zig && \
+    zig version
 # Install cargo-binstall
-RUN curl --retry 5 -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
+RUN curl --retry 5 -fL --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
 # Install cargo-chef & sccache & cargo-zigbuild
 RUN cargo binstall --no-confirm cargo-chef sccache cargo-zigbuild
 
@@ -73,11 +84,14 @@ RUN \
                 ;; \
         esac; \
     fi
-# Install FoundationDB
+# Install FoundationDB (pinned to latest 7.4.x; Apple publishes 7.4 as
+# prereleases on GitHub, so the release list is fetched without the
+# prerelease filter and narrowed by tag name).
+ARG FDB_VERSION_RANGE="7.4"
 RUN \
     source /env-cargo && \
     if [ ! -z "${FDB_ARCH}" ]; then \
-        curl --retry 5 -Lso fdb-client.deb "$(curl --retry 5 -Ls 'https://api.github.com/repos/apple/foundationdb/releases' | jq --arg FDB_ARCH "$FDB_ARCH" -r '.[] | select(.prerelease == false) | .assets[] | select(.name | test("foundationdb-clients.*" + $FDB_ARCH + ".deb$")) | .browser_download_url' | head -n1)" && \
+        curl --retry 5 -fLso fdb-client.deb "$(curl --retry 5 -fLs 'https://api.github.com/repos/apple/foundationdb/releases?per_page=100' | jq --arg FDB_ARCH "$FDB_ARCH" --arg RANGE "${FDB_VERSION_RANGE}" -r '[.[] | select(.tag_name | startswith($RANGE + "."))] | sort_by(.tag_name | split(".") | map(tonumber)) | reverse | .[0].assets[] | select(.name | test("foundationdb-clients.*" + $FDB_ARCH + ".deb$")) | .browser_download_url')" && \
         mkdir -p /fdb && \
         dpkg -x fdb-client.deb /fdb && \
         mv /fdb/usr/include/foundationdb /usr/include && \
@@ -100,8 +114,7 @@ RUN \
     --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/usr/local/cargo/git \
     source /env-cargo && \
-    cargo chef cook --recipe-path recipe.json --zigbuild --release --target ${TARGET} -p stalwart --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats enterprise" && \
-    cargo chef cook --recipe-path recipe.json --zigbuild --release --target ${TARGET} -p stalwart-cli
+    cargo chef cook --recipe-path recipe.json --zigbuild --release --target ${TARGET} -p stalwart --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats enterprise"
 # Copy the source code
 COPY . .
 ENV RUSTC_WRAPPER="sccache" \
@@ -125,9 +138,7 @@ RUN \
     --mount=type=cache,target=/usr/local/cargo/git \
     source /env-cargo && \
     cargo zigbuild --release --target ${TARGET} -p stalwart --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats enterprise" && \
-    cargo zigbuild --release --target ${TARGET} -p stalwart-cli && \
-    mv /app/target/${TARGET}/release/stalwart /app/artifact/stalwart && \
-    mv /app/target/${TARGET}/release/stalwart-cli /app/artifact/stalwart-cli
+    mv /app/target/${TARGET}/release/stalwart /app/artifact/stalwart
 
 # *****************
 # Binary stage
@@ -144,7 +155,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     apt-get update && \
     apt-get install -yq --no-install-recommends ca-certificates tzdata
 COPY --from=builder /app/artifact/stalwart /usr/local/bin
-COPY --from=builder /app/artifact/stalwart-cli /usr/local/bin
 COPY ./resources/docker/entrypoint.sh /usr/local/bin/entrypoint.sh
 RUN chmod -R 755 /usr/local/bin
 CMD ["/usr/local/bin/stalwart"]
@@ -159,7 +169,6 @@ FROM --platform=$TARGETPLATFORM alpine AS musl
 WORKDIR /opt/stalwart
 RUN apk add --update --no-cache ca-certificates tzdata && rm -rf /var/cache/apk/*
 COPY --from=builder /app/artifact/stalwart /usr/local/bin
-COPY --from=builder /app/artifact/stalwart-cli /usr/local/bin
 COPY ./resources/docker/entrypoint.sh /usr/local/bin/entrypoint.sh
 RUN chmod -R 755 /usr/local/bin
 CMD ["/usr/local/bin/stalwart"]